diff --git a/README.md b/README.md index 574987c..e2ce97e 100644 --- a/README.md +++ b/README.md @@ -22,6 +22,7 @@ ___________ .__ __ Live Forensicator is part of the Black Widow Toolbox, its aim is to assist Forensic Investigators and Incidence responders in carrying out a quick live forensic investigation.
It achieves this by gathering different system information for further review for anomalous behaviour or unexpected data entry, it also looks out for unusual files or activities and points it out to the investigator.
+The latest version now analysis Event Logs, it querries the event logs for certain log IDs that might point to an unusual activity or compromise.
It is paramount to note that this script has no inbuilt intelligence its left for the investigator to analyse the output and decide on a conclusion or decide on carrying out more deeper investigation.
## Optional Dependencies @@ -164,6 +165,12 @@ Forensicator can now encrypt the Artifact with a unique randomely generated key 4. SCHEDULED TASKS AND STATE 5. SERVICES 6. PERSISTANCE IN REGISTRY + + ======================================== + EVENTLOG ANALYSIS + ======================================== + 1. USER RELATED ACTIVITES. + 2. ================================= OTHER CHECKS @@ -198,6 +205,10 @@ Forensicator can now encrypt the Artifact with a unique randomely generated key ##ChangeLog ```bash +v3.2.1 29/06/2022 +Updated The UI +Added EventLog Analysis + v3.1.0 27/05/2022 Moved all the Binary Helpers to a folder. Added an inbuilt powershell based browser history extractor.